Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

ci: sandbox-note fixture depends on ambient provider credentials

Open Beginner friendly
  • Is something wrong?
#2,769 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
65/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
node.js, typescript
Domain
testing

Research direction

Start with tests/worker-sandbox-note.test.ts, especially its beforeEach, expectedNote, and piTurnContext setup, then inspect the exact-note assertions for the three existing cases. Make the fixture control and restore the relevant credential environment entries so ambient variables cannot change notes expected to contain no keys. Run the focused offline test command with an empty environment and controlled fictional values; done means both controls pass while the existing assertions remain intact.

Written by the indexing model from the issue text.

Description

area: ci type: test

Out of scope

  • Do not change product provider-credential admission, generated note semantics, isolation, offline guards or test deadlines.
  • Do not repeat the wide import-graph sweep to hide this fixture failure.

Context

The single wide preflight for #2747 on ada2e1767626ef6f4e8fa7ef50784998988eaa5c completed 626 distinct file reports (all 464 historical reference files plus 162 current additions), but failed two cases in tests/worker-sandbox-note.test.ts: PI_INIT_NOTE and GOVERNED_PI_INIT_RESOLVED_NOTE. The expected Secrets paragraph says the worker holds no provider keys; pi's actual paragraph names the admitted OPENAI_API_KEY and OPENROUTER_API_KEY variables. No credential values are needed to reproduce it.

The fixture sets HOME and the pi agent directory but does not establish its intended provider environment (beforeEach, tests/worker-sandbox-note.test.ts:32-46). Its expected note omits provider keys (expectedNote, tests/worker-sandbox-note.test.ts:55-61), while the pi helper opens a session using the ordinary host environment (piTurnContext, tests/worker-sandbox-note.test.ts:85-129). The production path computes the kept credentials (providerKeys, packages/ui-backend-pi/src/worker-session.ts:200-200) and includes them in the note (sandboxNote, packages/ui-backend-pi/src/worker-session.ts:230-232).

Focused offline controls on the same unchanged source: removing the five ambient provider variables used by this environment gives 3 passes; setting only OPENAI_API_KEY and OPENROUTER_API_KEY to the fictional odysseus-offline-sentinel gives 1 pass / 2 failures at those same note assertions. An earlier partial-clear diagnostic retained three other provider variables and also failed; a complete fixture environment is required. The wide command already clears ANTHROPIC_API_KEY, GEMINI_API_KEY and TYPESAFE_API_KEY, so clearing only those does not make this fixture hermetic.

Scope

Make the sandbox-note fixture establish and restore the provider environment relevant to its exact-note assertions. Keep the existing backend-owned new-tail, governed protection/history and staging-cleanup assertions.

Acceptance criteria

  • The existing three cases pass with the intended empty provider environment even when the caller sets nonempty provider variables.
  • Controlled fictional values for the relevant admitted provider variables prove that ambient state cannot alter an assertion that expects an empty provider list; all changed environment entries restore their original presence and values in teardown.
  • Preserve product provider admission and note behavior, offline guards, per-test deadlines, append-only history and every original behavioral assertion.
  • A mutation restoring ambient dependence fails the named exact-note assertion; restored focused controls pass.

Verification

Use scripts/test-offline.sh -- bun run test ./tests/worker-sandbox-note.test.ts with an explicitly empty provider environment and then controlled fictional values, retaining both exit codes and named assertions. No network or real provider key is required. Run the required local preflight and affected suites for the eventual repair; no further wide replay is authorized by this issue alone.

Contract impact

None expected. Test-fixture environment ownership only.

Dominant language
TypeScript
Stars
1
Forks
0
Avg merge
5h 38m
Merged PRs (30d)
960

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from schlessera/brain-kit

All issues in schlessera/brain-kit

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.